Confimedis GmbH
Version 2.0.0
Dear visitor, user, contract partner, interested party,
In accordance with the provisions of Articles 13, 14, and 21 of the General Data Protection Regulation (GDPR), we would like to inform you about the processing of your personal data and your related data protection rights. The specific data processed and the manner in which it is used are primarily determined by the requested or agreed services. To ensure that you are fully informed about the processing of your personal data in the context of the fulfillment of a contract or the execution of pre-contractual measures, please take note of the following information.
Responsible in the sense of the EU General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations:
Confimedis GmbH
Hafenweg 16
48155 Münster
Germany
Phone: +49 1590 5368729
Email: info@confimedis.com
We have appointed an external data protection officer:
Jörg ter Beek
Cortina Consult GmbH
Hafenweg 24
48155 Münster
Germany
Email: datenschutz@cortina-consult.de
The following notes provide an overview of what happens to your personal data when you visit our website (section 2) or use the Confimedis Platform (section 3). Personal data are all data with which you can be personally identified.
We process your personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Insofar as personal data are required for the initiation or execution of a contractual relationship or in the context of the execution of pre-contractual measures, processing is lawful according to Art. 6 Para. 1 lit. b GDPR.
If you give us express consent to process personal data for specific purposes (e.g., disclosure to third parties, evaluation for marketing purposes, or promotional approach via email), the legality of this processing is based on your consent according to Art. 6 Para. 1 lit. a GDPR. A given consent can be revoked at any time with effect for the future.
If necessary and legally permissible, we process your data beyond the actual contractual purposes to fulfill legal obligations according to Art. 6 Para. 1 lit. c GDPR. In addition, processing may occur to protect legitimate interests of us or third parties as well as to assert and defend legal claims according to Art. 6 Para. 1 lit. f GDPR. Where appropriate, we will inform you separately about the legitimate interest, provided that this is legally required.
Below you will find information on the data subject rights the applicable data protection law grants you against the controller with regard to the processing of your personal data:
The right to request information about your personal data processed by us according to Art. 15 GDPR. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, limitation of processing or objection, the existence of a right to complain, the source of your data if they were not collected by us, and the existence of automated decision-making including profiling and possibly meaningful information about their details.
The right to demand the immediate correction of incorrect or complete your personal data stored by us according to Art. 16 GDPR.
The right to request the deletion of your personal data stored by us according to Art. 17 GDPR, unless the processing is necessary to exercise the right of freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise or defend legal claims.
The right to demand the restriction of the processing of your personal data according to Art. 18 GDPR, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you refuse their deletion and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing according to Art. 21 GDPR.
The right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller according to Art. 20 GDPR.
The right to complain to a supervisory authority according to Art. 77 GDPR. As a rule, you can contact the supervisory authority of our above-mentioned seat, or if applicable, that of your usual place of residence or workplace.
The right to revoke consent given according to Art. 7 Para. 3 GDPR: You have the right to revoke your consent to the processing of data at any time with effect for the future. In the event of revocation, we will delete the affected data immediately, provided further processing cannot be based on a legal basis for processing without consent. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
If your personal data are processed by us based on legitimate interests according to Art. 6 Para. 1 S. 1 lit. f GDPR, you have the right according to Art. 21 GDPR to object to the processing of your personal data, provided there are reasons for this arising from your particular situation. As far as the objection is directed against the processing of personal data for the purpose of direct advertising, you have a general right of objection without the requirement of specifying a particular situation.
If you wish to exercise your right of revocation or objection, an email to the above-mentioned contact address is sufficient.
The provision of personal data for the decision on a contract conclusion, the fulfillment of the contract, or the execution of pre-contractual measures is voluntary. However, we can only make the decision within the framework of contractual measures if you provide personal data necessary for the contract conclusion, fulfillment, or pre-contractual measures.
We reserve the right to adapt or update this privacy policy if necessary in accordance with the applicable data protection regulations. In this way, we can adjust it to current legal requirements and take into account changes in our services, e.g., when introducing new services. The most current version applies to your visit.
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected:
The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
The legal basis for the temporary storage of data and log files is Art. 6 Para. 1 lit. f GDPR.
The storage in log files is to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
Our legitimate interest in data processing according to Art. 6 Para. 1 lit. f GDPR also lies in these purposes.
In the case of storing the data in log files, these are deleted after no more than seven days. Further storage is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.
Contacting us is possible via the provided email address, via our contact form, or via our online appointment booking on our website. In all cases, the user’s personal data transmitted with the contact will be stored.
The online appointment booking is provided via Microsoft Bookings, so that your details are processed by Microsoft in the process (see section 3.5). Beyond that, there is no disclosure of the data to third parties in this context. The data is used exclusively for processing the conversation.
The legal basis for processing the data transmitted in the course of contacting us is Art. 6 Para. 1 lit. f GDPR. If the contact aims at the conclusion of a contract, the additional legal basis is Art. 6 Para. 1 lit. b GDPR.
The processing of personal data from the input mask serves us solely to process the contact. This also constitutes the necessary legitimate interest in processing the data.
The data sent by you to us via contact requests remain with us until you request us to delete, object to the processing, or the purpose for the data storage lapses (e.g., after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.
The Confimedis Platform is provided exclusively on the basis of a contract between us and a customer, for example a hospital, a research institution, a sponsor, or a contract research organization. Without such a contract, it can only be used in the sandbox (section 3.7).
For the data processed in the platform, the respective customer is the controller within the meaning of the GDPR. This applies to user accounts of study staff and study participants as well as to all study data. We process this data as a processor according to Art. 28 GDPR, exclusively on behalf of and on the instructions of the customer.
The customer determines the purpose, the legal basis, and the storage period. These follow from the customer’s privacy information, for studies in particular from the participant information and the consent form. To exercise your rights, please contact the organization that provided your access or that conducts the study. We forward requests that reach us to that organization.
Sections 3.2 to 3.4 describe how the platform processes data technically. In sections 3.5 to 3.7, we are the controller ourselves.
For a user account, name, email address, and a password (stored only as a hash) are processed and, if used, also a phone number and data for two-factor authentication. Actions in the platform are recorded with user identifier and timestamp in an audit trail, as regulations for medical research require. To secure operation, the server also processes IP addresses, for example to limit requests and to detect failed access attempts.
User accounts and log data are deleted on the instructions of the customer or after the end of the contract with the customer.
The platform uses cookies and the local storage of your browser only as far as this is technically necessary for it to function. We do not use them for tracking, analytics, profiling, or advertising, and we do not embed third-party services for these purposes. Consent is therefore not required (§ 25 Para. 2 No. 2 TDDDG).
We operate the platform ourselves, including database, authentication, and file storage, in the Open Telekom Cloud in Germany. The Open Telekom Cloud is ISO 27001 certified. Backups are additionally replicated to an Open Telekom Cloud data centre in the Netherlands.
T-Systems International GmbH, Hahnstraße 43d, D-60528 Frankfurt am Main
We have concluded a data processing agreement according to Art. 28 GDPR with T-Systems. If a customer operates the platform on its own infrastructure, that infrastructure takes the place of the Open Telekom Cloud. The customer then also connects the services for email and SMS delivery and the AI assistant itself, so that the following information on our service providers does not apply.
We use further service providers only for the following functions, in each case as processors and with processing within the EU:
In addition:
Of contact persons at our customers and prospects, we process name, role, contact details, and contract and billing data in order to initiate, perform, and invoice contracts.
The legal basis is Art. 6 Para. 1 lit. b GDPR insofar as you are our contractual partner yourself, otherwise Art. 6 Para. 1 lit. f GDPR (legitimate interest in communicating with the contact persons of our contractual partners). For retention obligations under commercial and tax law, Art. 6 Para. 1 lit. c GDPR applies.
Recipients are Microsoft (email communication, appointment booking, and online meetings), Lexware (invoicing), and our tax advisor. The provider of the Microsoft services is Microsoft Ireland Operations Limited in Ireland. Insofar as data is transferred to Microsoft Corporation in the USA in the process, this is safeguarded by the adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally by standard contractual clauses according to Art. 46 Para. 2 lit. c GDPR.
The data is deleted after the end of the business relationship, contract and billing documents after the statutory retention periods have expired (up to ten years).
If you contact us with a support request, we process your contact details and the content of the request in order to handle it.
The legal basis is Art. 6 Para. 1 lit. b GDPR insofar as you are our contractual partner yourself, otherwise Art. 6 Para. 1 lit. f GDPR (legitimate interest in handling your request).
Requests are deleted once the matter has been resolved, unless statutory retention obligations apply.
In our sandbox (sandbox.confimedis.com), you can try out the platform without a contract and without a user account. For this, we are the controller ourselves.
The sandbox runs in your browser. Your entries are stored locally in your browser and are not transmitted to us. You can remove them at any time by deleting the website data in your browser. The AI assistant is an exception: if you use it, your requests are transmitted to our server and from there to Mistral AI (section 3.4).
When you open the sandbox, access data is also processed as when you visit our website (section 2.1). The legal basis in each case is Art. 6 Para. 1 lit. f GDPR (legitimate interest in offering the platform to try out without obligation).